Does Washington's My Health My Data Act apply to my app?
Who the law covers, what counts as consumer health data, and the checklist an app has to meet. Written for developers and the coding agents working for them.
Short answer
Probably, if your app collects anything about a user's physical or mental health and people in Washington can use it. The law has no revenue or user-count threshold, so small apps are covered too. It also allows private lawsuits through Washington's Consumer Protection Act, which makes it riskier than most state privacy laws. The law has not been amended since it was enacted in 2023.
Who it covers
The law applies to a "regulated entity": a business that operates in Washington or offers products or services aimed at Washington consumers, and that decides why and how consumer health data is collected. A "consumer" includes Washington residents and anyone whose consumer health data is collected in Washington. A consumer app available nationwide usually meets both tests.
Specified HIPAA-regulated information and data covered by certain other federal laws are exempt. Most consumer apps are not covered by HIPAA, and the law reaches health data that HIPAA does not, so HIPAA compliance alone is not a complete answer.
What counts as consumer health data
The definition is broad. It covers information that is linked or reasonably linkable to a person and identifies their past, present, or future physical or mental health. Examples include:
- conditions, symptoms, diagnoses, and treatments
- medications and supplements
- bodily functions, vital signs, and measurements
- mood, mental health, and emotional state
- reproductive or sexual health information
- biometric and genetic data
- precise location that could show someone seeking health care
- inferences about health drawn from other data
A mood tracker, a medication reminder, symptom notes, sleep logs, and a "health" section in a journaling or planning app can all qualify.
What the law requires
- A separate consumer health data privacy policy, with a link to it prominently on your homepage. It cannot simply be folded into your main privacy policy.
- Consent to collect. The law requires specific, informed, opt-in consent, separate from acceptance of your terms, except to the extent the collection is necessary to provide a product or service the consumer requested. The exception is limited to that necessary processing. It does not cover unrelated uses such as advertising, profiling, or AI model training. Because "necessary" can be disputed, many apps ask for consent anyway.
- Separate consent to share health data, subject to the same exception for sharing necessary to provide the requested service. Sharing with a processor under a binding contract is treated differently.
- A signed authorization to sell health data, with specific required contents. Consent in your terms of service is not enough. Most apps should simply not sell it.
- Consumer rights: to confirm and access their data (including a list of third parties it went to), to withdraw consent, and to delete. Respond without undue delay and within 45 days of receiving the request. Verifying the user's identity does not extend that deadline. One 45-day extension is allowed when reasonably necessary, if you tell the user why within the first 45 days. You also need an appeal process for refusals.
- Backups. Deletion from archived or backup systems may be delayed, but by no more than six months after the deletion request is authenticated. This is not an extension for deleting live data.
- Processor contracts with vendors that handle health data for you.
- Access limits and data security appropriate to the sensitivity of the data.
- No health-related geofencing. You may not set up a geofence within 2,000 feet of the perimeter of a place that provides in-person health care when it is used to identify or track people seeking care, collect their health data, or send them health-related messages or ads. This has applied since July 23, 2023. It is not a ban on all location technology near medical facilities.
Nevada and Connecticut
Both have consumer health data laws of their own, but they are not copies of Washington's.
- Nevada (SB 370, effective 2024) uses a similar opt-in consent model and restricts geofencing within 1,750 feet. It has no private right of action.
- Connecticut added consumer health data protections to its privacy law in 2023, including limits on selling health data and on geofencing within 1,750 feet of specified facilities. The Attorney General enforces it.
A design that meets Washington's requirements usually covers most of theirs, but check the differences.
Enforcement so far
Enforcement has developed more slowly than many expected. Washington's Attorney General has described a measured approach while the law is new, and no public enforcement judgment or settlement under the Act had been announced as of this guide's date. Private plaintiffs are testing it: a consolidated case against Amazon over its advertising SDK ended in voluntary dismissals without a ruling on the Act, and a 2025 case against a telehealth company remains pending. Courts have not yet given much guidance on how the law will be read.
Checklist an agent can run against the codebase
- List every field, screen, and integration that stores health-related information, including free-text fields where users are likely to write about health, and any place the product infers health information.
- Confirm whether that data reaches your servers or stays on the device.
- Check whether onboarding has a health-data consent that is separate from terms acceptance, unchecked by default, and recorded with a timestamp and the exact wording shown.
- List every use of health data beyond providing the feature the user asked for (analytics, advertising, model training) and flag each one.
- Check that a user can withdraw consent in Settings as easily as they granted it, and what happens to existing data when they do.
- Check that no analytics, crash-reporting, or advertising SDK receives health data, including through session replay or autocapture.
- Check what deletion removes and how long backups keep it.
- Check for any geofencing around health care locations.
- Find the consumer health data privacy policy link on the website homepage, in the app, and in the app store listing.
If this applies to you
If you are launching, the app launch legal package covers the consumer health data policy, the consent flow, and a build spec your agent can implement. If you already have policies and are adding a health feature, a pre-build feature check covers that one change.